@inproceedings{bourigault-bourigault-2026-voiceagentguard,
title = "{V}oice{A}gent{G}uard: Contract-Gated Tool Release for Production Voice Agents",
author = "Bourigault, Emmanuelle and
Bourigault, Pauline",
editor = "Atanasova, Pepa and
Haffari, Gholamreza and
Wang, Minghan",
booktitle = "Proceedings of the 2026 Conference on Empirical Methods in Natural Language Processing: Industry Track",
month = oct,
year = "2026",
address = "Budapest, Hungary",
publisher = "Association for Computational Linguistics",
url = "https://aclanthology.org/2026.emnlp-industry.195/",
pages = "3281--3296",
ISBN = "979-8-89176-460-6",
abstract = "Voice agents increasingly issue tool calls that disclose private information or modify external state. Correct intent recognition is not sufficient for authorization when identity, entity values, confirmation, or policy evidence is stale, missing, or contradictory. We introduce VoiceAgentGuard, a model-agnostic runtime gate that separates a planner{'}s proposed action from release. For every private-read or mutating call, it builds a Voice Action Contract from independently maintained identity state, entity revisions, confirmation evidence, policy support, schema validity, risk tier, and handoff requirements. A deterministic, side-effect-free validator either executes the call or returns a repair action: clarify, confirm, block, or handoff. SafeOutcome credits policy-correct completion, blocking, and escalation while penalizing unsupported execution. On a 480-task GPT-5.5 transfer, VoiceAgentGuard reduces unsafe release from 0.250 to 0.017 relative to an LLM guard with comparable pass@1. On 2,400 perturbed traces, it improves SafeOutcome from 0.417 to 0.733 and lowers unsafe release from 0.568 to 0.100. On 480 held-out adaptive attacks, unsafe release is 0.075 versus 0.340 for the LLM guard, with 1.55 ms median warm-path latency. Grounded, live-planner, and real-speech checks show that explicit contracts turn insufficient evidence into auditable repair rather than unsafe execution."
}<?xml version="1.0" encoding="UTF-8"?>
<modsCollection xmlns="http://www.loc.gov/mods/v3">
<mods ID="bourigault-bourigault-2026-voiceagentguard">
<titleInfo>
<title>VoiceAgentGuard: Contract-Gated Tool Release for Production Voice Agents</title>
</titleInfo>
<name type="personal">
<namePart type="given">Emmanuelle</namePart>
<namePart type="family">Bourigault</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Pauline</namePart>
<namePart type="family">Bourigault</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<originInfo>
<dateIssued>2026-10</dateIssued>
</originInfo>
<typeOfResource>text</typeOfResource>
<relatedItem type="host">
<titleInfo>
<title>Proceedings of the 2026 Conference on Empirical Methods in Natural Language Processing: Industry Track</title>
</titleInfo>
<name type="personal">
<namePart type="given">Pepa</namePart>
<namePart type="family">Atanasova</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Gholamreza</namePart>
<namePart type="family">Haffari</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Minghan</namePart>
<namePart type="family">Wang</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<originInfo>
<publisher>Association for Computational Linguistics</publisher>
<place>
<placeTerm type="text">Budapest, Hungary</placeTerm>
</place>
</originInfo>
<genre authority="marcgt">conference publication</genre>
<identifier type="isbn">979-8-89176-460-6</identifier>
</relatedItem>
<abstract>Voice agents increasingly issue tool calls that disclose private information or modify external state. Correct intent recognition is not sufficient for authorization when identity, entity values, confirmation, or policy evidence is stale, missing, or contradictory. We introduce VoiceAgentGuard, a model-agnostic runtime gate that separates a planner’s proposed action from release. For every private-read or mutating call, it builds a Voice Action Contract from independently maintained identity state, entity revisions, confirmation evidence, policy support, schema validity, risk tier, and handoff requirements. A deterministic, side-effect-free validator either executes the call or returns a repair action: clarify, confirm, block, or handoff. SafeOutcome credits policy-correct completion, blocking, and escalation while penalizing unsupported execution. On a 480-task GPT-5.5 transfer, VoiceAgentGuard reduces unsafe release from 0.250 to 0.017 relative to an LLM guard with comparable pass@1. On 2,400 perturbed traces, it improves SafeOutcome from 0.417 to 0.733 and lowers unsafe release from 0.568 to 0.100. On 480 held-out adaptive attacks, unsafe release is 0.075 versus 0.340 for the LLM guard, with 1.55 ms median warm-path latency. Grounded, live-planner, and real-speech checks show that explicit contracts turn insufficient evidence into auditable repair rather than unsafe execution.</abstract>
<identifier type="citekey">bourigault-bourigault-2026-voiceagentguard</identifier>
<location>
<url>https://aclanthology.org/2026.emnlp-industry.195/</url>
</location>
<part>
<date>2026-10</date>
<extent unit="page">
<start>3281</start>
<end>3296</end>
</extent>
</part>
</mods>
</modsCollection>
%0 Conference Proceedings
%T VoiceAgentGuard: Contract-Gated Tool Release for Production Voice Agents
%A Bourigault, Emmanuelle
%A Bourigault, Pauline
%Y Atanasova, Pepa
%Y Haffari, Gholamreza
%Y Wang, Minghan
%S Proceedings of the 2026 Conference on Empirical Methods in Natural Language Processing: Industry Track
%D 2026
%8 October
%I Association for Computational Linguistics
%C Budapest, Hungary
%@ 979-8-89176-460-6
%F bourigault-bourigault-2026-voiceagentguard
%X Voice agents increasingly issue tool calls that disclose private information or modify external state. Correct intent recognition is not sufficient for authorization when identity, entity values, confirmation, or policy evidence is stale, missing, or contradictory. We introduce VoiceAgentGuard, a model-agnostic runtime gate that separates a planner’s proposed action from release. For every private-read or mutating call, it builds a Voice Action Contract from independently maintained identity state, entity revisions, confirmation evidence, policy support, schema validity, risk tier, and handoff requirements. A deterministic, side-effect-free validator either executes the call or returns a repair action: clarify, confirm, block, or handoff. SafeOutcome credits policy-correct completion, blocking, and escalation while penalizing unsupported execution. On a 480-task GPT-5.5 transfer, VoiceAgentGuard reduces unsafe release from 0.250 to 0.017 relative to an LLM guard with comparable pass@1. On 2,400 perturbed traces, it improves SafeOutcome from 0.417 to 0.733 and lowers unsafe release from 0.568 to 0.100. On 480 held-out adaptive attacks, unsafe release is 0.075 versus 0.340 for the LLM guard, with 1.55 ms median warm-path latency. Grounded, live-planner, and real-speech checks show that explicit contracts turn insufficient evidence into auditable repair rather than unsafe execution.
%U https://aclanthology.org/2026.emnlp-industry.195/
%P 3281-3296
Markdown (Informal)
[VoiceAgentGuard: Contract-Gated Tool Release for Production Voice Agents](https://aclanthology.org/2026.emnlp-industry.195/) (Bourigault & Bourigault, EMNLP 2026)
ACL